[Bro-Dev] Call for opinions on logging framework syntax problem

Gregor Maier gregor at icir.org
Wed Nov 30 11:46:30 PST 2011

On 11/30/11 8:32 , Robin Sommer wrote:
> On Tue, Nov 29, 2011 at 19:04 -0800, you wrote:
>>     orig_p.port orig_p.proto
> Hmm ... I like that too but it breaks when ports are in sets/vectors,
> and it gets ugly with ports in records. We could do it just for
> top-level fields but that would be quite inconsistent.

Yeah. I can see sets, vectors being a problem, however, wouldn't it 
break in the same way as sets/vectors of record types?

For ports in records it would just be:
cid.orig_p.port cid.orig_p.proto

That doesn't seem to bad.

Gregor Maier
<gregor at icir.org>  <gregor at icsi.berkeley.edu>
Int. Computer Science Institute (ICSI)
1947 Center St., Ste. 600
Berkeley, CA 94704, USA

More information about the bro-dev mailing list